How to Use the Checkmarx MCP in LangChain

Q: How do I build a LangChain agent to get Checkmarx scan results?

Your agent should first call runscan to start the process. It then uses the returned scan ID to poll getscandetails until the status is 'Completed'. Finally, it passes that same ID to getscanresults to get the actual findings.

Q: Can my LangChain agent find the best place to fix a Checkmarx vulnerability?

Yes. After getting vulnerabilities from getscanresults, your agent can pass the scan ID and rule ID to listbfl. This tool returns the Best Fix Location, pointing directly to the code that offers the most impact for a fix.

Q: What's the best way to handle multiple projects in Checkmarx with LangChain?

Use listprojects to get a list of all available projects and their IDs. Your agent can then select the correct project ID to use with runscan or listscans. This ensures your chains always operate on the right codebase.

Q: Is it possible to check Infrastructure as Code with this server?

Absolutely. The getkicsresults tool is designed for this. Your agent can call it to find misconfigurations in Terraform, Kubernetes YAML, or Dockerfiles, separate from your main application code scans.

Build autonomous AppSec agents for Checkmarx with LangChain. This MCP Server connects your chains directly to your security scans.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Checkmarx MCP to LangChain

Create your Vinkius account to connect Checkmarx to LangChain and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Checkmarx with LangChain

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Chain Scans and Results

Start a workflow with `run_scan`. Your agent gets the scan ID, then polls `get_scan_details` until the scan is 'Completed'. It then passes that ID to `get_scan_results` to pull the vulnerability data. This creates a simple, effective CI/CD-style chain. You're not just running a scan; you're building a process that reacts to its own results. The output of one tool call becomes the input for the next, letting your agent work through a problem step-by-step without human intervention.

Pinpoint the Best Fix Location

Your agent can take a high-severity finding from `get_scan_results` and feed its details into `list_bfl`. This tool points to the exact file and lines of code for the most efficient fix. No more guesswork about where to start. It's a direct path from problem to solution. You can also build chains that specifically target infrastructure issues by calling `get_kics_results` to check your Terraform or Kubernetes configurations.

Manage Projects with Your LangChain MCP Server

Before kicking off any workflow, your agent can use `list_applications` and `list_projects` to get its bearings. It finds the right project ID and confirms the context before acting. This prevents it from scanning the wrong repository or branch. If a developer pushes a new commit mid-scan, a separate chain can trigger `cancel_scan` to avoid wasting resources on outdated code. This adds a layer of intelligence to your automation. It's a core benefit of using an MCP architecture.

Setup guide

Set up Checkmarx MCP in LangChain

Prerequisites

Python 3.10+ installed
langchain-mcp-adapters + langgraph packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install langchain-mcp-adapters langgraph langchain-openai. The MCP adapters package converts MCP tools into native LangChain BaseTool objects.
2

Connect via HTTP transport
Use MultiServerMCPClient with "transport": "http" pointing to your Vinkius endpoint. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Create a ReAct agent
Pass the discovered tools to create_react_agent() from LangGraph. The agent automatically routes Checkmarx tool calls through the MCP protocol.
4

Run with any LLM
Swap ChatOpenAI for ChatAnthropic, ChatGoogleGenerativeAI, or any LangChain-compatible model. The MCP tools work identically across all providers.

agent.py

from langchain_mcp_adapters.client import MultiServerMCPClient
from langgraph.prebuilt import create_react_agent
from langchain_openai import ChatOpenAI

async with MultiServerMCPClient({
    "checkmarx-mcp": {
        "transport": "http",
        "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp",
    }
}) as client:
    tools = client.get_tools()

    agent = create_react_agent(
        ChatOpenAI(model="gpt-4o"),
        tools,
    )
    result = await agent.ainvoke({
        "messages": "List recent Checkmarx transactions"
    })
    print(result["messages"][-1].content)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Checkmarx. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Checkmarx now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Checkmarx MCP in LangChain

Your agent should first call `run_scan` to start the process. It then uses the returned scan ID to poll `get_scan_details` until the status is 'Completed'. Finally, it passes that same ID to `get_scan_results` to get the actual findings.

Yes. After getting vulnerabilities from `get_scan_results`, your agent can pass the scan ID and rule ID to `list_bfl`. This tool returns the Best Fix Location, pointing directly to the code that offers the most impact for a fix.

Use `list_projects` to get a list of all available projects and their IDs. Your agent can then select the correct project ID to use with `run_scan` or `list_scans`. This ensures your chains always operate on the right codebase.

Absolutely. The `get_kics_results` tool is designed for this. Your agent can call it to find misconfigurations in Terraform, Kubernetes YAML, or Dockerfiles, separate from your main application code scans.

The server processes your project and scan metadata, including source code locations, vulnerability details, and scan IDs. Your credentials aren't stored. Every request is authenticated with an ephemeral token inside Vinkius's zero-trust sandbox, isolating your data.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript